So I wrote essentially the same chrome extension (albeit a different interface, which definitely allows for this vulnerability): http://lettergram.github.io/An

So I wrote essentially the same chrome extension (albeit a different interface, which definitely allows for this vulnerability): http://lettergram.github.io/AnyCrypt/ http://lettergram.github.io/AnyCrypt/ https://github.com/lettergram/AnyCrypt https://github.com/lettergram/AnyCrypt https://chrome.google.com/webstore/detail/anycrypt/hddfngccl.. https://chrome.google.com/webstore/detail/anycrypt/hddfngccl.... It worked fairly well (haven't tested it in a bit), but I had to reverse engineer pretty much all the Keybase APIs at the time. The thing is, the author is totally correct. I wrote mine as a proof of concept, and quite frankly was surprised that the Keybase chrome extension (even a year ago when I checked) had the same issue(s) my implementation did... That being said, this isn't an "end-of-the-world" kind of thing, I think there are several easy solutions to this problem as the author pointed out. Personally though, only 3 people use my extension with me. I couldn't get anyone to use the Keybase extension.. so I really think they should just update that phrasing on their extension page (perhaps add a warning) and let it be.